PluginScore

WordPress.DB.PreparedSQL.InterpolatedNotPrepared

Interpolated SQL is not prepared

Variables are interpolated into a SQL string before the query is prepared.

critical weight

Why It Shows Up

The scan found dynamic values placed directly inside SQL, often through string interpolation, before `$wpdb->prepare()` can safely bind them.

Why It Matters

Preparing a query after unsafe interpolation does not reliably protect the dynamic value.

How to Fix

  • Replace interpolated variables with placeholders.
  • Pass each dynamic value as a separate `$wpdb->prepare()` argument.
  • Use allowlists for SQL identifiers and directions that cannot be represented as normal values.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#101Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output is not escaped
#102WP Compress – Instant Performance & Speed Optimization213,3673,25310k+Non Singular String Literal Domain
#103WP-Lister Lite for eBay216,6975,1292k+Output is not escaped
#104WP phpMyAdmin214,5286,43550k+Missing Arg Domain
#105wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8111,43270k+Output is not escaped
#106WP Extended – The Ultimate WordPress Toolkit211,253398600Non Singular String Literal Domain
#107WPScan – WordPress Security Scanner215272658k+Text Domain Mismatch
#108WebTotem Security211,110213900Text Domain Mismatch
#109Advanced Classifieds & Directory Pro221,2293,5112k+Non-prefixed global variable
#110Ajax Load More – Infinite Scroll, Load More, & Lazy Load2264159540k+Unsafe printing function
#111All-in-One Video Gallery229112,89220k+Non-prefixed global variable
#112Knowledge Base documentation & wiki plugin – BasePress Docs226711,7672k+Non-prefixed global variable
#113Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots221,6072,02010k+Direct Query
#114Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms2249329510k+Text Domain Mismatch
#115Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD226697691k+Output is not escaped
#116Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8581,27050k+Text Domain Mismatch
#117Passster – Password Protect Pages and Content225391,41910k+Non-prefixed global variable
#118RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6535,0848k+Non-prefixed global variable
#119Data Tables Generator by Supsystic2215815210k+Exception output is not escaped
#120Directorist: AI-Powered Business Directory, Listings & Classified Ads225492,17520k+Non-prefixed global variable
#121DirectoryPress – Business Directory And Classified Ad Listing224,7872,795800Text Domain Mismatch
#122Download Manager222,5131,462100k+Output is not escaped
#123Dynamic QR Code – generator222382086k+Missing direct file access protection
#124Easy Social Feed – Social Photos Gallery and Post Feed for WordPress221,5671,27730k+Non-prefixed global variable
#125easyReservations225,3072,480800Text Domain Mismatch
#126Employee Spotlight – Team Member Showcase & Meet the Team Plugin22247689400Non-prefixed hook name
#127ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce228285,9695k+Direct Query
#128Estatik Real Estate Plugin223,04932510k+Text Domain Mismatch
#129Events Manager – Calendar, Bookings, Tickets, and more!224,7135,66070k+Output is not escaped
#130FACTO – Facturación Electrónica22242432400Request data is not unslashed
#131Falang multilanguage for WordPress227167691k+Output is not escaped
#132Finale Lite – Sales Countdown Timer & Discount for WooCommerce221,0314514k+Output is not escaped
#133FireBox Popups – Increase Sales and Grow Your Email List221538127k+Non-prefixed global variable
#134Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder22407236700k+Text Domain Mismatch
#135GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4663,97210k+Output is not escaped
#136Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms221,03772220k+Unsafe printing function
#137Hesabfa Accounting22467718400Text Domain Mismatch
#138History Log by click5226751,290400Direct Query
#139Csomagpontok és Címkék WooCommerce-hez222,0017697k+Text Domain Mismatch
#140IMPress for IDX Broker221,0856366k+Text Domain Mismatch
#141The Innovative Form Builder – IvyForms22713250600Exception output is not escaped
#142InfiniteWP Client222,2861,812200k+Exception output is not escaped
#143LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,3693,34970k+Non-prefixed global variable
#144Mail Baby SMTP22385699600SQL query is not prepared
#145MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.222,6252,45810k+Output is not escaped
#146Modula Image Gallery – Photo Grid & Video Gallery22474436100k+Text Domain Mismatch
#147Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress229191,23010k+Output is not escaped
#148myCred Addons – Ultimate myCred Modules To Support WordPress Gamification and Loyalty Rewards222,3441,320400Output is not escaped
#149WP OAuth Server (OAuth Authentication)221893473k+Non-prefixed function
#150PagBank / PagSeguro Connect para WooCommerce225057574k+Non-prefixed global variable